Computer networks are plagued with vulnerabilities. Vulnerabilities are weaknesses in computers and devices caused, for example, by bugs or misconfigurations. Attackers attack computer networks by exploiting vulnerabilities, frequently causing damages such as denial of service and theft of corporate secrets. Attackers often exploit several vulnerabilities in a row starting with one device, attacking several devices along the way, and ending at the final target device. Attackers may start attacks from the Internet, an intranet, or any other network.
Consequently, security assessments are performed by, for example, security staff. Typically, security assessments are manual labor intensive processes performed several times per year in various forms such as security audits, penetration testing, and certification & accreditation.
For various reasons, security assessments have become very complex. For example, large networks may have a great many vulnerabilities. In addition, network environments may change extremely frequently, and new vulnerabilities are discovered almost every day. In order to determine the business impact of vulnerabilities, each vulnerability must be examined in both a network and a business context. The impact of a given vulnerability can vary depending on where the vulnerability is found. Furthermore, accuracy of an assessment is compromised when new changes in the network or applications are made. Yesterday's assessment may become obsolete in a day due to the dynamic nature of present day IT environments. All of these factors can have a dramatic negative effect on the efficiency, accuracy, and timeliness of security assessments. Moreover, security incidents are on the rise.
Various detection or assessment devices, such as scanners, can be of use in helping to detect vulnerabilities at a component level, but such devices do not address or incorporate business or IT context considerations. As such, they cannot, for example, provide an overall security “big picture,” they cannot help security staff to understand the business impact of any given vulnerability, and they do not enable accurate prioritization of vulnerabilities on a real time or almost real time basis.
A number of references discuss systems and methods to assist security staff in performing security assessments. For example, U.S. Pat. No. 6,324,656, entitled, “System and Method for Rules-Driven Multi-Phase Network Vulnerability Assessment,” by Gleichauf et al. discusses a method for performing pinging and port scans of devices on a network to detect vulnerabilities. Gleichauf et al., however, among other shortcomings, limits its methods to pinging and port scanning and does not integrate its scanning methods with other information such as access control lists and business rules.
A January 1998 Sandia National Laboratories report entitled, “A Graph-Based Network-Vulnerability Analysis System,” by Swiler et al. discusses a graph-based approach to network vulnerability analysis. The system requires as input a database of common attacks, broken into atomic steps, specific network configuration and topology information, and an attacker profile. The attack information is matched with topology information and an attacker profile to create a superset attack graph. Nodes identify a step of attack and arcs represent attacks or steps of attacks. By assigning probabilities of success on the arcs or costs representing level-of-effort for the attacker, various graph algorithms such as shortest-path algorithms can identify the attack paths with the highest probability of success. Swiler et al., however, among other shortcomings, uses an inefficient algorithm that is not practical for use in actual field situations having many network nodes and possible attacks that could be launched by an attacker, and does not generate corresponding fixes to eliminate the threats posed by the vulnerabilities.
Today, security assessment is still a manual, labor-intensive process that requires a security savvy person to perform. Due to its manual fashion, the security assessment process as a whole is a snapshot-oriented process that requires large amounts of time to conduct and cannot be performed continuously.
During the scanning phase of vulnerability assessments, a large number of assessed atomic vulnerabilities are generally found. Herein, the term “atomic vulnerability” generally includes vulnerabilities associated with a network node. Immediately fixing all vulnerabilities is not a viable solution due to time and resource constraints. Further, vulnerabilities are not static and new vulnerabilities are often discovered on subsequent scans due to changing network topologies and new vulnerabilities being published. Security staff thus must frequently choose which vulnerabilities to fix. Making this choice in production networks is extremely difficult since halting and changing a production network often requires proof of actual risk of damage to the organization's business, rather than a mere presence of a technical vulnerability.
There is thus a need for systems and methods to conduct security assessments automatically in a computer network.